feat(orchestrator)!: S0 English everywhere, Sécurité, NATO hashes, ICAO digits

Requirement 001 phase 6, S0:

- Speech: the security class shows as "Sécurité" and is spoken as in
  maritime radio, "say-cure-ee-tay" three times. A hex run of 7 or more
  characters with a letter and a digit (commit, session, message ids) is
  spelled in the NATO alphabet; every other digit is spoken on its own
  in ICAO pronunciation (42305: four two tree zero fife). The spelling
  runs inside clip() before the length cut, so a phrase still fits
  SPEECH_LIMIT; the displayed text keeps its digits and hashes.
- English: every orchestrator label, tooltip, message, error, script
  output, document and test string is English (Regeln -> Firewall,
  Hierarchie -> Hierarchy, Steuerung -> Controls, Ausführen -> Run, ...);
  the page declares lang="en" and formats dates as en-GB. Task filter
  ids are English. German stays only in the skill trigger phrases that
  quote the operator, and as identifiers: the view keys (view=) and the
  leitstand id.
- tests/test_english.py scans every tracked text file for umlauts and
  German words, with an allowlist of the quoted trigger phrases.

BREAKING CHANGE: the Stream search tokens art: and seit: are now kind:
and since:; an old art: or seit: token counts as a plain word.

Evidence: make test 657 OK, ruff and markdownlint clean
(/tmp/s0-make-test-1.log); e2e 17 OK, none skipped (/tmp/s0-e2e-1.log);
MEDUSA 86 files, 24 findings on reworded strings accepted after an
independent skeptic (21 path:line, 0 rejected, no behaviour change in
signing, approving, rules, denying, offices, events), rescan 0 open.

🎯 Fix: 93 %
💥 Break: 4 %
💸 Cost: 100 %
⏱️ Time: –
🛡️ Security: 100 %
🏆 Score: 89
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_hub_redirects.py

@@ -221,7 +221,7 @@ class TestRedirects(unittest.TestCase):
 
     def test_only_https_urls_are_probed(self):
         before = len(cdn().dialed)
-        self.assertEqual(self.resolver().resolve(["http://10.0.0.5:8000/nacht", STATION]), {"http://10.0.0.5:8000/nacht": ([], ""), STATION: (["https://*.cdn.test"], "")})
+        self.assertEqual(self.resolver().resolve(["http://10.0.0.5:8000/night", STATION]), {"http://10.0.0.5:8000/night": ([], ""), STATION: (["https://*.cdn.test"], "")})
         self.assertEqual(len(cdn().dialed) - before, 2)
 
     def test_media_sources_widen_one_label_and_pass_the_settings_check(self):
@@ -284,9 +284,9 @@ class TestRedirectSettings(HubCase):
         self.assertEqual(set(prepared), {"payload", "challenge", "credentials"})
         self.assertEqual(prepared["payload"]["items"], [signing.item_hash(signing.stream_item(["https://attacker.radio.test"], [streams[0]["url"]]))])
         unsigned = self.post_json("/api/settings", {**self.payload(streams), "proof": None}, self.guard(self.host))
-        self.assertEqual(unsigned[:3:2], (400, b"nicht signiert: no signature\n"))
+        self.assertEqual(unsigned[:3:2], (400, b"not signed: no signature\n"))
         stranger = {**self.payload(streams), "proof": key(-7, "stranger").proof(prepared["payload"], self.origin)}
-        self.assertEqual(self.post_json("/api/settings", stranger, self.guard(self.host))[:3:2], (400, b"nicht signiert: the signing key is not pinned\n"))
+        self.assertEqual(self.post_json("/api/settings", stranger, self.guard(self.host))[:3:2], (400, b"not signed: the signing key is not pinned\n"))
         self.assertEqual(self.dials(), before)
         self.assertNotIn("attacker.radio.test", cdn().httpd.asked)
         self.assertFalse((self.state / "settings.json").exists())
@@ -326,7 +326,7 @@ class TestRedirectSettings(HubCase):
         self.assertEqual(self.prepared(streams)["payload"]["items"], [signing.item_hash(signing.stream_item(["https://station.radio.test"], [other["url"]]))])
         before = self.dials()
         unsigned = self.post_json("/api/settings", {**self.payload(streams), "proof": None}, self.guard(self.host))
-        self.assertEqual(unsigned[:3:2], (400, b"nicht signiert: no signature\n"))
+        self.assertEqual(unsigned[:3:2], (400, b"not signed: no signature\n"))
         self.assertEqual(self.dials(), before)
         self.assertEqual(self.httpd.hub.settings.get(), saved)